The Rising Barcode Security Threat

eldavojohn writes "As more and more businesses become dependent on barcodes, people are pointing out common problems involving the security of one- or two-dimensional barcode software. You might scoff at this as a highly unlikely hacking platform but from the article, 'FX tested the access system of an automatically operated DVD hire shop near his home. This actually demanded a biometric check as well, but he simply refused it. There remained a membership card with barcode, membership number and PIN. After studying the significance of the bar sequences and the linear digit combinations underneath, FX managed to obtain DVDs that other clients had already paid for, but had not yet taken away. Automated attacks on systems were also possible, he claimed. But you had to remember not to use your own membership number.' The article also points out that boarding passes work on this basis — with something like GNU Barcode software and a template of printed out tickets, one might be able to take some nice vacations."

Comments

Re:This is a fairly obvious vector

[jimmyswimmy]

I used to work at a semiconductor fab - basically a big chemical factory. Access control, security and timecards were all kept by a barcode system, printed on the back of your badge. I had a lot of fun making bar codes to see which would get me into places I shouldn't have been, like the spaces between the cleanroom walls, or the tunnel under the building, or the chemical storage area (that was a place I didn't ever like being in). Probably seems worse now than it did then.

Back in elementary school we had a stored-value system for buying lunch, with security based on bar codes on little plastic cards. This was nearly 20 years ago and there was free software available then (on my Commodore 64? Atari? Can't remember) to generate bar codes. I made a couple, based on the ID numbers of friends, and gave them to the lunch lady, telling her that those cards were a bad idea. They never changed anything, though. These days I'd have been kicked out of school for that, though, if not arrested.

Not entirely accurate...

[Anonymous Coward]

I've done this for kicks just to see if I could do it, but once I brought one of my fake ID's and fake boarding passes to the airport and got through the "security" (security? BAHAHAHA!) and made it into the terminal. Bought some drinks, ate some food and went home.

No one was the wiser.

You see, it's just a billion dollar FARCE and a WASTE OF TAXPAYERS MONEY for the *feeling* of safety when there really isn't any.

Of course I couldn't get on the plane. I couldn't get on a plane in 2001 without a correct ticket anyways. They had the barcode scanners to "check" you into the plane anyhow. At least, I remember them being available back in 1999 -AND- I wasn't too keene on getting onto a plane where there weren't enough seats where I'd get caught :P

Anyways, just as I said, this is easy to blow a hole through. There's nothing in the world that makes me more mad than being patted down, scanned or searched before boarding PUBLIC TRANSIT. I'm not a criminal, wtf are government agencies doing there?

(posted anon and through a couple anon proxies)